Skip to content

Fress v1.0.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 14:35
· 34 commits to main since this release
v1.0.4
ab2e272
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fress v1.0.4 — the quota-proof fallback release

The last path to "No download was started: the download sources could not be reached" is closed. v1.0.3 made the catalog's source lookups resilient (retries, quota conservation, stale-while-error); v1.0.4 adds the fallback for the one case that remained: a repository never looked up before, inside an exhausted rate-limit window. When the GitHub REST API still fails, the resolver now reads GitHub's own quota-free release documents instead of surfacing the error.

The fallback

  • The atom feed + asset fragments answer what the API answered. github.com/<repo>/releases.atom lists recent releases; the per-tag expanded_assets fragment carries one anchor per uploaded asset. Parsing is fail-closed: slug-validated URLs, a conservative tag charset, a bounded budget of fragment fetches per run, and entries that cannot be confidently attributed to the exact repository are skipped rather than guessed. The honest "no stable release" answer short-circuits the fallback; any other API failure earns one quota-free second opinion; if the fallback also fails, the original classified error is kept — the Retry button and failure kinds behave exactly as before.
  • A dedicated shape-validated request class. The review pass rejected the branch's original approach (widening the generic resolver-manifest allowlist with github.com) because a pinned audit invariant keeps github.com off the generic text policy — that invariant is what confines the self-update checksum document to its path-pinned policy. The shipped form admits github.com only for exactly the two release-document shapes, at admission and on every redirect hop; everything else on github.com fails closed.
  • Boundary-exact e2e deny-all carve-out (PR #111). The test harness's loopback exception matched hosts that merely start with localhost — localhost.evil.com would have slipped the net. Now the boundary is host-exact, pinned by unit tests.

Security posture

Unchanged and re-verified: URL admission, redirect rules, the public-address-only resolver, the minisign-verified self-update chain and the shape gate above are all enforced in the native layer; the audit's §10.14 round-6 documentation ships in this release (PR #109), and write_part_meta's contract doc now states the real fail-closed resume behavior (PR #112).

Quality

  • cargo test 275 passed / 0 failed · clippy -D warnings clean · fmt clean · 12/12 CI checks green
  • vitest 897 passed / 2 skipped (61 files) · tsc --noEmit clean · validate:versions 8 fields agree on 1.0.4

Full changelog: https://github.com/WasewaseX/Fress/blob/main/CHANGELOG.md

Assets 24
Loading